Pinpoint APM CVE-2026-57947

Q: What is the CVSS score of CVE-2026-57947?

CVE-2026-57947 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40164 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-29 disclosure@vulncheck.com

GHSA-xx75-4fhf-jf2w

Authentication Bypass SSRF Suse

6.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Network-exploitable by low-privileged authenticated users with scope change to internal systems; high confidentiality impact from potential cloud credential harvest via metadata endpoints.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 18:38 vuln.today

DescriptionCVE.org

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

AnalysisAI

Server-side request forgery in Pinpoint APM through version 3.1.0 allows authenticated users with low privileges to register internal or cloud-metadata URLs as alarm webhook targets due to missing URL validation on the webhook registration endpoint. By deliberately triggering alarm threshold breaches, an attacker can coerce the Pinpoint server to issue outbound POST requests to internal hosts, cloud metadata services (such as AWS IMDS at 169.254.169.254), or other non-routable internal infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system confidentiality impact is rated High, reflecting the potential to enumerate internal services or harvest cloud credentials.

Technical ContextAI

Pinpoint is an open-source APM (Application Performance Monitoring) platform, primarily built for Java/JVM-based applications and commonly used in large-scale Korean and Asian tech stacks. CWE-918 (Server-Side Request Forgery) applies here: the webhook registration API accepts arbitrary URLs submitted by authenticated users without validating whether the target host falls within a permitted allowlist or is blocked from internal address ranges. When an alarm condition is met, the Pinpoint server acts as an HTTP client and POSTs to the registered URL on behalf of the triggering event, effectively becoming an open proxy. The affected component is the alarm webhook registration endpoint, exposed over the network (AV:N per CVSS 4.0). The CVSS 4.0 vector (SC:H, SI:L) indicates that while the vulnerable Pinpoint system itself has limited direct impact (VC:L), the risk to subsequent systems - internal microservices, metadata endpoints, and backend databases reachable only from the server - is rated High confidentiality and Low integrity.

RemediationAI

The primary remediation is to upgrade Pinpoint to a version beyond 3.1.0 that includes SSRF protection on the webhook registration endpoint; however, no exact patched version number was confirmed in the provided input data - monitor the upstream GitHub issue at https://github.com/pinpoint-apm/pinpoint/issues/13857 for a confirmed fix release. Until a patch is applied, implement egress firewall rules on the Pinpoint server host to block outbound connections to RFC 1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata service addresses (169.254.169.254 for AWS/Azure/GCP IMDS, 100.100.100.200 for Alibaba Cloud). The trade-off of egress filtering is potential disruption to legitimate internal webhook targets; audit existing webhook registrations before enforcing the block. For cloud deployments, additionally enforce IMDSv2 (requiring PUT-initiated token exchange) on AWS EC2 instances, which prevents simple unauthenticated GET-based metadata retrieval even if SSRF is achieved via POST. Restrict the Pinpoint alarm webhook feature to trusted administrators only via role-based access controls if the platform supports it, reducing the attack surface to high-privilege accounts.